<?php if (!defined('DASHBOARD_ROOT')) define('DASHBOARD_ROOT', realpath(__DIR__ . '/../..')); require_once DASHBOARD_ROOT . '/api/bootstrap.php'; header('Content-Type: application/json'); if ($_SERVER['REQUEST_METHOD'] !== 'POST') { exit(json_encode(['success' => false, 'error' => 'POST required'])); } CSRF::enforce(); RBAC::enforce('create.content'); $rowId = (int)($_POST['row_id'] ?? 0); $productId = (int)($_POST['product_id'] ?? 0); if (!$rowId || !$productId) { exit(json_encode(['success' => false, 'error' => 'row_id and product_id required'])); } $row = Database::fetchOne("SELECT id FROM storefront_rows WHERE id = :id", [':id' => $rowId]); if (!$row) { exit(json_encode(['success' => false, 'error' => 'Row not found'])); } $product = Database::fetchOne("SELECT id, title, price, image_url FROM products WHERE id = :id", [':id' => $productId]); if (!$product) { exit(json_encode(['success' => false, 'error' => 'Product not found'])); } $titleDec = ''; try { $titleDec = Encryption::decrypt($product['title']); } catch (\Throwable $e) { $titleDec = 'Product'; } $priceDec = $product['price'] ?? '0.00'; $encTitle = Encryption::encrypt($titleDec, 'product'); $encPrice = Encryption::encrypt((string)$priceDec, 'product'); $next = Database::fetchOne("SELECT COALESCE(MAX(item_order),0)+1 as n FROM order_items WHERE row_id = :r", [':r' => $rowId]); $nextOrder = (int)($next['n'] ?? 1); $newId = Database::insert( "INSERT INTO order_items (row_id, item_type, item_ref_id, slot_width, item_order, product_title_enc, product_price_enc, product_image_url)      VALUES (:r, 'product', :pid, 1, :o, :t, :p, :img)", [':r' => $rowId, ':pid' => $productId, ':o' => $nextOrder, ':t' => $encTitle, ':p' => $encPrice, ':img' => $product['image_url']] ); exit(json_encode([ 'success' => true, 'item' => [ 'id' => $newId, 'item_type' => 'product', 'slot_width' => 1, 'product_title_enc' => $titleDec, 'product_price_enc' => $priceDec, 'image_url' => $product['image_url'] ] ])); 